<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="cobaltstrike, YeOrLuOp">
    <meta name="description" content="">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>cobaltstrike | YeOrLuOp</title>
    <link rel="icon" type="image/png" href="/favicon.png">

    <link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/css/my.css">

    <script src="/libs/jquery/jquery.min.js"></script>

<meta name="generator" content="Hexo 4.2.0"><link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css"></head>




<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">YeOrLuOp</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">YeOrLuOp</div>
        <div class="logo-desc">
            
            Never really desperate, only the lost of the soul.
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        
    </ul>
</div>


        </div>

        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/11.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">cobaltstrike</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        margin: 35px 0 15px 0;
        padding-left: 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        height: calc(100vh - 250px);
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;

        position: absolute;
        right: 23.5vw;
        display: block;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/tags/%E5%B7%A5%E5%85%B7/">
                                <span class="chip bg-color">工具</span>
                            </a>
                        
                            <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                                <span class="chip bg-color">学习笔记</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                    <div class="post-cate">
                        <i class="fas fa-bookmark fa-fw icon-category"></i>
                        
                            <a href="/categories/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-category">
                                网络安全
                            </a>
                        
                    </div>
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2020-11-08
                </div>
                

                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-check fa-fw"></i>更新日期:&nbsp;&nbsp;
                    2020-11-08
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-file-word fa-fw"></i>文章字数:&nbsp;&nbsp;
                    3k
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-clock fa-fw"></i>阅读时长:&nbsp;&nbsp;
                    12 分
                </div>
                

                
            </div>
        </div>
        <hr class="clearfix">
        <div class="card-content article-card-content">
            <div id="articleContent">
                <center>cobaltstrike学习笔记</center>

<h1 id="这是干啥的"><a href="#这是干啥的" class="headerlink" title="这是干啥的"></a>这是干啥的</h1><blockquote>
<p>C/S架构</p>
</blockquote>
<ol>
<li>Cobalt Strike 是一个为对手模拟和红队行动而设计的平台，主要用于执行有目标的攻击和模拟高级威胁者的后渗透行动</li>
</ol>
<h1 id="菜单"><a href="#菜单" class="headerlink" title="菜单"></a>菜单</h1><h2 id="Help"><a href="#Help" class="headerlink" title="Help"></a>Help</h2><table>
<thead>
<tr>
<th>Homepage</th>
<th>官方网站</th>
</tr>
</thead>
<tbody><tr>
<td>Support</td>
<td>技术支持，文档介绍</td>
</tr>
<tr>
<td>Arsenal</td>
<td>武器库工具集（需正版授权码）</td>
</tr>
<tr>
<td>System information</td>
<td>系统及版本信息</td>
</tr>
<tr>
<td>About</td>
<td>关于</td>
</tr>
</tbody></table>
<h2 id="Reporting"><a href="#Reporting" class="headerlink" title="Reporting"></a>Reporting</h2><table>
<thead>
<tr>
<th>Activity report</th>
<th>活动报告</th>
</tr>
</thead>
<tbody><tr>
<td>Hosts report</td>
<td>主机报告</td>
</tr>
<tr>
<td>Indicators of Compromise</td>
<td>威胁报告</td>
</tr>
<tr>
<td>Sessions report</td>
<td>会话报告</td>
</tr>
<tr>
<td>Social engineering report</td>
<td>社会工程学报告</td>
</tr>
<tr>
<td>Tactics, Techniques, and Procedures</td>
<td>策略、技巧和程序</td>
</tr>
<tr>
<td>Reset Data</td>
<td>重置数据</td>
</tr>
<tr>
<td>Export Data</td>
<td>导出数据</td>
</tr>
</tbody></table>
<h2 id="Attacks-gt-Web-Drive-by"><a href="#Attacks-gt-Web-Drive-by" class="headerlink" title="Attacks -&gt; Web Drive-by"></a>Attacks -&gt; Web Drive-by</h2><table>
<thead>
<tr>
<th>Manage</th>
<th>对开启的web服务进行管理</th>
</tr>
</thead>
<tbody><tr>
<td>Clone Site</td>
<td>克隆网站(可记录受害者提交的数据)</td>
</tr>
<tr>
<td>Host File</td>
<td>提供Web以供下载某文件</td>
</tr>
<tr>
<td>Scripted Web Delivery</td>
<td>提供Web服务，便于下载和执行PowerShell Payload，类似于Metasploit的web_delivery</td>
</tr>
<tr>
<td>Signed Applet Attack</td>
<td>启动一个Web服务以提供自签名Java Applet的运行环境</td>
</tr>
<tr>
<td>Smart Applet Attack</td>
<td>自动检测Java版本并利用已知的exploits绕过security</td>
</tr>
<tr>
<td>System Profiler</td>
<td>用来获取一些系统信息，比如系统版本，Flash版本，浏览器版本等</td>
</tr>
</tbody></table>
<h2 id="Attacks-gt-Packages"><a href="#Attacks-gt-Packages" class="headerlink" title="Attacks -&gt; Packages"></a>Attacks -&gt; Packages</h2><table>
<thead>
<tr>
<th>HTML Application</th>
<th>生成恶意的HTA木马文件</th>
</tr>
</thead>
<tbody><tr>
<td>MS Office Macro</td>
<td>生成office宏病毒文件</td>
</tr>
<tr>
<td>Payload Generator</td>
<td>生成各种语言版本的payload</td>
</tr>
<tr>
<td>Windows Executable</td>
<td>生成Windows可执行payload</td>
</tr>
<tr>
<td>Windows Executable(S)</td>
<td>把包含payload,Stageless生成可执行文件(包含多数功能)</td>
</tr>
</tbody></table>
<h2 id="View"><a href="#View" class="headerlink" title="View"></a>View</h2><table>
<thead>
<tr>
<th>Applications</th>
<th>应用(显示受害者机器的应用信息)</th>
</tr>
</thead>
<tbody><tr>
<td>Credentials</td>
<td>凭证(通过hashdump或Mimikatz抓取过的密码都会储存在这里)</td>
</tr>
<tr>
<td>Downloads</td>
<td>下载文件</td>
</tr>
<tr>
<td>Event Log</td>
<td>事件日志(主机上线记录以及团队协作聊天记录)</td>
</tr>
<tr>
<td>Keystrokes</td>
<td>键盘记录</td>
</tr>
<tr>
<td>Proxy Pivots</td>
<td>代理模块</td>
</tr>
<tr>
<td>Screenshots</td>
<td>受害者机器屏幕截图</td>
</tr>
<tr>
<td>Script Console</td>
<td>脚本控制台(可以加载各种脚本，增强功能<a href="https://github.com/rsmudge/cortana-scripts" target="_blank" rel="noopener">https://github.com/rsmudge/cortana-scripts</a>)</td>
</tr>
<tr>
<td>Targets</td>
<td>显示目标主机</td>
</tr>
<tr>
<td>Web Log</td>
<td>Web日志</td>
</tr>
</tbody></table>
<h2 id="Cobalt-Strike"><a href="#Cobalt-Strike" class="headerlink" title="Cobalt Strike"></a>Cobalt Strike</h2><table>
<thead>
<tr>
<th>New Connection</th>
<th>新的连接(支持连接多个服务器端)</th>
</tr>
</thead>
<tbody><tr>
<td>Preferences</td>
<td>偏好设置(设置Cobal Strike界面、控制台、以及输出报告样式、TeamServer连接记录等)</td>
</tr>
<tr>
<td>Visualization</td>
<td>窗口视图模式(展示输出结果的形式)</td>
</tr>
<tr>
<td>VPN Interfaces</td>
<td>VPN接入</td>
</tr>
<tr>
<td>Listenrs</td>
<td>监听器(创建Listener)</td>
</tr>
<tr>
<td>Script Manager</td>
<td>脚本管理</td>
</tr>
<tr>
<td>Close</td>
<td>关闭客户端</td>
</tr>
</tbody></table>
<h1 id="参考（多看看，多跟着练一练加深理解）"><a href="#参考（多看看，多跟着练一练加深理解）" class="headerlink" title="参考（多看看，多跟着练一练加深理解）"></a>参考（多看看，多跟着练一练加深理解）</h1><ol>
<li><p><a href="https://www.4hou.com/posts/qD87" target="_blank" rel="noopener">https://www.4hou.com/posts/qD87</a></p>
</li>
<li><p><a href="https://xz.aliyun.com/t/7997" target="_blank" rel="noopener">https://xz.aliyun.com/t/7997</a></p>
</li>
<li><p><a href="https://www.freebuf.com/articles/web/246863.html" target="_blank" rel="noopener">https://www.freebuf.com/articles/web/246863.html</a></p>
</li>
<li><p><a href="https://tophub.today/search?q=cobalt+strike" target="_blank" rel="noopener">https://tophub.today/search?q=cobalt+strike</a></p>
</li>
<li><p><a href="http://blog.nsfocus.net/cobalt-strike-phishing-0913/" target="_blank" rel="noopener">http://blog.nsfocus.net/cobalt-strike-phishing-0913/</a></p>
</li>
<li><p><a href="https://www.cobaltstrike.com/support" target="_blank" rel="noopener">https://www.cobaltstrike.com/support</a></p>
</li>
<li><p><a href="https://mp.weixin.qq.com/s/f6zQiRNDtCn9lQps3yeJGg" target="_blank" rel="noopener">https://mp.weixin.qq.com/s/f6zQiRNDtCn9lQps3yeJGg</a></p>
</li>
<li><p><a href="https://github.com/No-Github/1earn/blob/master/1earn/Security/%E5%AE%89%E5%85%A8%E5%B7%A5%E5%85%B7/CobaltStrike.md" target="_blank" rel="noopener">https://github.com/No-Github/1earn/blob/master/1earn/Security/%E5%AE%89%E5%85%A8%E5%B7%A5%E5%85%B7/CobaltStrike.md</a></p>
</li>
<li><p><a href="https://www.freebuf.com/column/149236.html" target="_blank" rel="noopener">https://www.freebuf.com/column/149236.html</a></p>
</li>
<li><p><a href="https://hub.packtpub.com/red-team-tactics-getting-started-with-cobalt-strike-tutorial/" target="_blank" rel="noopener">https://hub.packtpub.com/red-team-tactics-getting-started-with-cobalt-strike-tutorial/</a></p>
</li>
<li><p><a href="https://cloud.tencent.com/developer/article/1666653" target="_blank" rel="noopener">https://cloud.tencent.com/developer/article/1666653</a></p>
</li>
<li><p><a href="http://blog.leanote.com/post/snowming/50448511de58" target="_blank" rel="noopener">http://blog.leanote.com/post/snowming/50448511de58</a></p>
</li>
<li><p><a href="https://0verwatch.top/LAN-pentest-learning-7.html#Mimikatz" target="_blank" rel="noopener">https://0verwatch.top/LAN-pentest-learning-7.html#Mimikatz</a></p>
</li>
<li><p><a href="https://my.oschina.net/u/4587410/blog/4551030" target="_blank" rel="noopener">https://my.oschina.net/u/4587410/blog/4551030</a></p>
</li>
</ol>
<pre class=" language-bash"><code class="language-bash">  cobaltstrike4.0-cracked tree
<span class="token keyword">.</span>
├── CobaltstrikeCN.jar  <span class="token comment" spellcheck="true"># 汉化包</span>
├── LICENSE.txt
├── NOTICE.TXT
├── agscript
├── c2lint
├── cobaltstrike.auth
├── cobaltstrike.bat
├── cobaltstrike.icns <span class="token comment" spellcheck="true"># 图标 无</span>
├── cobaltstrike.jar <span class="token comment" spellcheck="true"># 主程序</span>
├── cobaltstrike.store 无
├── crackInfo.txt
├── icon.jpg
├── libicmp.so
├── libicmp64.so
├── libtapmanager.so
├── libtapmanager64.so
├── peclone
├── readme.txt
├── start.bat
├── start.sh
├── teamserver
└── third-party
    ├── README.winvnc.txt
    ├── winvnc.x64.dll 无
    └── winvnc.x86.dll 无

1 directory, 24 files</code></pre>
<h1 id="攻击问题集"><a href="#攻击问题集" class="headerlink" title="攻击问题集 "></a>攻击问题集 <img src="C:%5CUsers%5CRESCUER%5CDesktop%5C%E6%94%BB%E5%87%BB%E9%97%AE%E9%A2%98%E9%9B%86.jpg" alt=""></h1><h1 id="cobaltstrike-Beacon"><a href="#cobaltstrike-Beacon" class="headerlink" title="cobaltstrike Beacon"></a>cobaltstrike Beacon</h1><p>功能：</p>
<ol>
<li>远程线程注入，可指定目标进程名称或pid；</li>
<li>Spawn，将beacon shell 派生至新的程序；</li>
<li>命名管道，连接、关闭指定命名管道，使用命名管道通信；</li>
<li>文件操作，上传与下载文件，修改文件时间；</li>
<li>文件系统操作，切换目录、创建删除文件夹、写入环境变量等；</li>
<li>命令行执行，直接执行指定的cmd命令；</li>
<li>网络监听，包括创建服务端并监听指定端口、本地网络通信转发等；</li>
<li>获取信息，查看所有进程信息，查看指定目录下文件信息；</li>
<li>创建服务，将指定程序以服务方式运行；</li>
<li>权限操作，包括检查权限，提升权限；</li>
<li>Shellcode执行，使用powershell通过指定端口下载并运行；</li>
<li>域内渗透，使用kerberos凭据</li>
</ol>
<h2 id="通信方式"><a href="#通信方式" class="headerlink" title="通信方式"></a>通信方式</h2><h3 id="4-0前"><a href="#4-0前" class="headerlink" title="4.0前"></a>4.0前</h3><ol>
<li><p>反向shell 和反向 HTTP C2 通道</p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107134207911.png" alt="image-20201107134207911"></p>
</li>
</ol>
<h3 id="4-0"><a href="#4-0" class="headerlink" title="4.0"></a>4.0</h3><h2 id="job命令"><a href="#job命令" class="headerlink" title="job命令"></a>job命令</h2><h2 id="desktop-命令"><a href="#desktop-命令" class="headerlink" title="desktop 命令"></a>desktop 命令</h2><blockquote>
<ol start="12">
<li></li>
</ol>
</blockquote>
<h1 id="工具条"><a href="#工具条" class="headerlink" title="工具条"></a>工具条</h1><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201105213628666.png" alt="image-20201105213628666"></p>
<h1 id="Cobalt-Strike-桌面控制问题"><a href="#Cobalt-Strike-桌面控制问题" class="headerlink" title="Cobalt Strike 桌面控制问题"></a>Cobalt Strike 桌面控制问题</h1><h1 id="Browser-Pivoting（浏览器跳板攻击"><a href="#Browser-Pivoting（浏览器跳板攻击" class="headerlink" title="Browser Pivoting（浏览器跳板攻击)"></a>Browser Pivoting（浏览器跳板攻击)</h1><h2 id="概念相关"><a href="#概念相关" class="headerlink" title="概念相关"></a>概念相关</h2><blockquote>
<p>浏览器跳板攻击可以让攻击者以受害主机上的终端用户的身份来访问浏览器上开着的应用。攻击者可以继承目标用户对于网站的访问权限，相当于直接跳过了对于浏览器上的应用程序的身份验证</p>
</blockquote>
<img src="C:\Users\RESCUER\AppData\Roaming\Typora\typora-user-images\image-20201107145600156.png" alt="image-20201107145600156" style="zoom:80%;" />

<h2 id="实现原理"><a href="#实现原理" class="headerlink" title="实现原理"></a>实现原理</h2><h3 id="socks-跳板-代理跳板"><a href="#socks-跳板-代理跳板" class="headerlink" title="socks 跳板/代理跳板"></a>socks 跳板/代理跳板</h3><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107145817937.png" alt="image-20201107145817937"></p>
<h2 id="为什么可以实现"><a href="#为什么可以实现" class="headerlink" title="为什么可以实现"></a>为什么可以实现</h2><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107145948865.png" alt="image-20201107145948865"></p>
<h3 id="winINet库"><a href="#winINet库" class="headerlink" title="winINet库"></a>winINet库</h3><blockquote>
<p>工作原理：</p>
<ol>
<li>进程注入。浏览器跳板技术将一个 agent（代理）注入到 IE 浏览器进程中；</li>
<li>在团队服务器上创建一个 HTTP 代理服务器。到时候攻击者通过请求此代理服<br>务器的 IP 和端口，进而变成了 agent 的一个请求任务；</li>
<li>当攻击者从自己的浏览器请求 web 应用时，IE 中的 agent （代理）将此请求<br>转化为对 WinINet 库的 API 调用；</li>
<li>恰好， WinINet 也是 IE 浏览器用于 web 通信和管理身份认证的库。Internet<br>Explorer 将其所有通信委托给 WinINet 库。并且使用 WinINet 这个库来管理<br>其用户的 cookies、SSL 会话和服务器身份验证；</li>
<li>基于相同的进程上下文，使用此库来进行一个 web 请求可以引发免费的透明<br>再验证。攻击者的 web 请求于是获取了终端用户的 cookies、SSL 会话和服务<br>器身份验证；</li>
<li>最终，攻击者的 web 请求就成为了当前开着的 IE 浏览器的进行的一个新的请<br>求。</li>
</ol>
</blockquote>
<ol start="2">
<li>操作：<ol>
<li>设置浏览器跳板</li>
<li>通过 chromium 浏览器访问 web 应用</li>
</ol>
</li>
</ol>
<h2 id="通过-beacon-内置的-socks-功能将本地-Msf-直接代入目标内网进行操作"><a href="#通过-beacon-内置的-socks-功能将本地-Msf-直接代入目标内网进行操作" class="headerlink" title="通过 beacon 内置的 socks 功能将本地 Msf 直接代入目标内网进行操作"></a>通过 beacon 内置的 socks 功能将本地 Msf 直接代入目标内网进行操作</h2><blockquote>
<p>总结来说就是需要先有一个 CS Beacon shell，然后通过 socks 理，把受害主机的流量代理到本地的 msf，然后本地 msf 就可以进行一些内网探测或漏洞利用。</p>
<blockquote>
<blockquote>
<p>CS 的通讯模型中，客户端不会直接与 payload 进行连接，都是必须经过团队服务<br>器的。以团队服务器为中介，这是 CS 设计的一种的安全机制</p>
</blockquote>
</blockquote>
</blockquote>
<h3 id="原理"><a href="#原理" class="headerlink" title="原理"></a>原理</h3><h2 id="借助-CS-的外部-tcp-监听器通过-ssh-隧道直接派生一个meterpreter-的-shell-到本地"><a href="#借助-CS-的外部-tcp-监听器通过-ssh-隧道直接派生一个meterpreter-的-shell-到本地" class="headerlink" title="借助 CS 的外部 tcp 监听器通过 ssh 隧道直接派生一个meterpreter 的 shell 到本地"></a>借助 CS 的外部 tcp 监听器通过 ssh 隧道直接派生一个meterpreter 的 shell 到本地</h2><blockquote>
<p>cs中可以用inject或spawn将payload注入到内存中</p>
</blockquote>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107180724328.png" alt="image-20201107180724328"></p>
<h3 id="操作"><a href="#操作" class="headerlink" title="操作"></a>操作</h3><ol>
<li>在本地 MSF 上创建监听器</li>
<li>给本地 MSF 一个公网地址</li>
<li>在 CS 上创建外部监听器</li>
<li>spawn</li>
</ol>
<h1 id="Aggressor-Script"><a href="#Aggressor-Script" class="headerlink" title="Aggressor Script"></a>Aggressor Script</h1><p><a href="https://www.cobaltstrike.com/aggressor-script/index.html" target="_blank" rel="noopener">https://www.cobaltstrike.com/aggressor-script/index.html</a></p>
<h1 id="团队服务器隐匿"><a href="#团队服务器隐匿" class="headerlink" title="团队服务器隐匿"></a>团队服务器隐匿</h1><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107142843569.png" alt="image-20201107142843569"></p>
<h1 id="Cobalt-Strike-中的权限维持和团队服务器之间的会话传递"><a href="#Cobalt-Strike-中的权限维持和团队服务器之间的会话传递" class="headerlink" title="Cobalt Strike 中的权限维持和团队服务器之间的会话传递"></a>Cobalt Strike 中的权限维持和团队服务器之间的会话传递</h1><p><a href="https://github.com/DeEpinGh0st/Erebus" target="_blank" rel="noopener">https://github.com/DeEpinGh0st/Erebus</a></p>
<h2 id="权限维持"><a href="#权限维持" class="headerlink" title="权限维持"></a>权限维持</h2><blockquote>
<p>前提：Beacon Shell 必须是高权限，不然通过 SC 命令加服务的话不会成功</p>
</blockquote>
<p>操作步骤：</p>
<ol>
<li>加载 cna 脚本：Cobalt Strike → Script Manager → Load → Erebus 中的 Main.cna</li>
<li>生成 Payload 可执行文件：Attacks<code>→</code>Packages<code>→</code>Windows Executable(S)</li>
<li>上传 payload 可执行文件至目标主机</li>
<li>通过插件添加服务</li>
<li>重启目标机器测试 Beacon 留存</li>
</ol>
<h2 id="在团队服务器之间传递-Beacon-Shell"><a href="#在团队服务器之间传递-Beacon-Shell" class="headerlink" title="在团队服务器之间传递 Beacon Shell"></a>在团队服务器之间传递 Beacon Shell</h2><p>步骤：</p>
<ol>
<li>准备工作 —— 把 Beacon 转移到更安全的进程上</li>
<li>第一步：准备工作 —— 把 Beacon 转移到更安全的进程上</li>
<li>把会话传递到另一台团队服务器上</li>
</ol>
<h1 id="Cobalt-Strike-amp-MetaSploit-联动"><a href="#Cobalt-Strike-amp-MetaSploit-联动" class="headerlink" title="Cobalt Strike &amp; MetaSploit 联动"></a>Cobalt Strike &amp; MetaSploit 联动</h1><blockquote>
<p>流量转发</p>
</blockquote>
<h1 id="使用-Cobalt-Strike-对-Linux-主机进行后渗透"><a href="#使用-Cobalt-Strike-对-Linux-主机进行后渗透" class="headerlink" title="使用 Cobalt Strike 对 Linux 主机进行后渗透"></a>使用 Cobalt Strike 对 Linux 主机进行后渗透</h1><h1 id="Bypass-UAC"><a href="#Bypass-UAC" class="headerlink" title="Bypass UAC"></a>Bypass UAC</h1><h1 id="Initial-Access"><a href="#Initial-Access" class="headerlink" title="Initial Access"></a>Initial Access</h1><h2 id="spear-phishing"><a href="#spear-phishing" class="headerlink" title="spear phishing"></a>spear phishing</h2><h2 id="tradecraft"><a href="#tradecraft" class="headerlink" title="tradecraft"></a>tradecraft</h2><h2 id="client-side-attack-process"><a href="#client-side-attack-process" class="headerlink" title="client-side attack process"></a>client-side attack process</h2><h1 id="Post-Exploitation"><a href="#Post-Exploitation" class="headerlink" title="Post Exploitation"></a>Post Exploitation</h1><h1 id="Privilege-Escalation"><a href="#Privilege-Escalation" class="headerlink" title="Privilege Escalation"></a>Privilege Escalation</h1><h1 id="MSF-sleep与CobaltStrike-sleep"><a href="#MSF-sleep与CobaltStrike-sleep" class="headerlink" title="MSF sleep与CobaltStrike sleep"></a>MSF sleep与CobaltStrike sleep</h1><p><a href="https://www.anquanke.com/post/id/216363" target="_blank" rel="noopener">https://www.anquanke.com/post/id/216363</a></p>
<h1 id="execute-assembly"><a href="#execute-assembly" class="headerlink" title="execute-assembly"></a>execute-assembly</h1><p><a href="https://www.anquanke.com/post/id/220456" target="_blank" rel="noopener">https://www.anquanke.com/post/id/220456</a></p>
<h1 id="Lateral-Movement"><a href="#Lateral-Movement" class="headerlink" title="Lateral Movement"></a>Lateral Movement</h1><h2 id="host-and-user-enumeration"><a href="#host-and-user-enumeration" class="headerlink" title="host and user enumeration"></a>host and user enumeration</h2><h2 id="remote-control-of-systems"><a href="#remote-control-of-systems" class="headerlink" title="remote control of systems"></a>remote control of systems</h2><h2 id="remote-code-execution-with-the-Beacon-payload"><a href="#remote-code-execution-with-the-Beacon-payload" class="headerlink" title="remote code execution with the Beacon payload"></a>remote code execution with the Beacon payload</h2><h2 id="steal-tokens"><a href="#steal-tokens" class="headerlink" title="steal tokens"></a>steal tokens</h2><h2 id="use-credentials"><a href="#use-credentials" class="headerlink" title="use credentials"></a>use credentials</h2><h2 id="pass-the-hash"><a href="#pass-the-hash" class="headerlink" title="pass-the-hash"></a>pass-the-hash</h2><h2 id="generate-Kerberos-Golden-这个还真没明白什么意思"><a href="#generate-Kerberos-Golden-这个还真没明白什么意思" class="headerlink" title="generate Kerberos Golden(这个还真没明白什么意思)"></a>generate Kerberos Golden(这个还真没明白什么意思)</h2><h1 id="listener"><a href="#listener" class="headerlink" title="listener"></a>listener</h1><h2 id="创建监听器9中payload选项"><a href="#创建监听器9中payload选项" class="headerlink" title="创建监听器9中payload选项"></a>创建监听器9中payload选项</h2><h3 id="内部的Listener"><a href="#内部的Listener" class="headerlink" title="内部的Listener"></a>内部的Listener</h3><blockquote>
<p>Beacon为内置的Listener即在目标主机执行相应的payload，获取shell到CS上</p>
<p>其中包含DNS、HTTP、HTTPS、SMB</p>
<p>Beacon可以选择通过DNS还是HTTP协议出口网络，你甚至可以在使用Beacon通讯过程中切换HTTP和DNS</p>
<p>其支持多主机连接，部署好Beacon后提交一个要连回的域名或主机的列表，Beacon将通过这些主机轮询</p>
<p>目标网络的防护团队必须拦截所有的列表中的主机才可中断和其网络的通讯</p>
<p>通过种种方式获取shell以后（比如直接运行生成的exe），就可以使用Beacon了。</p>
</blockquote>
<ul>
<li>windows/beacon_dns/reverse_dns_txt</li>
<li>windows/beacon_dns/reverse_http</li>
<li>windows/beacon_http/reverse_http</li>
<li>windows/beacon_https/reverse_https </li>
<li>windows/beacon_smb/bind_pipe</li>
</ul>
<h3 id="外部的Listener"><a href="#外部的Listener" class="headerlink" title="外部的Listener"></a>外部的Listener</h3><blockquote>
<p>Foreign为外部结合的Listener，常用于MSF的结合，例如获取meterpreter到MSF上。</p>
</blockquote>
<ul>
<li>windows/foreign/reverse_dns_txt</li>
<li>windows/foreign/reverse_http</li>
<li>windows/foreign/reverse_https</li>
<li>windows/foreign/reverse_tcp</li>
</ul>
<h1 id="Pivoting"><a href="#Pivoting" class="headerlink" title="Pivoting"></a>Pivoting</h1><h2 id="find-targets-with-port-scanning"><a href="#find-targets-with-port-scanning" class="headerlink" title="find targets with port scanning"></a>find targets with port scanning</h2><h2 id="how-to-pivot-to-and-control-UNIX-targets-with-Cobalt-Strike’s-SSH-sessions"><a href="#how-to-pivot-to-and-control-UNIX-targets-with-Cobalt-Strike’s-SSH-sessions" class="headerlink" title="how to pivot to and control UNIX targets with Cobalt Strike’s SSH sessions"></a>how to pivot to and control UNIX targets with Cobalt Strike’s SSH sessions</h2><h1 id="启动命令"><a href="#启动命令" class="headerlink" title="启动命令"></a>启动命令</h1><pre class=" language-bash"><code class="language-bash"><span class="token function">cd</span> /Users/sec/Documents/Sec/cobaltstrike4.0-cracked <span class="token operator">&amp;&amp;</span> java -Xdock:icon<span class="token operator">=</span>cobaltstrike.icns -Dfile.encoding<span class="token operator">=</span>UTF-8 -javaagent:CobaltStrikeCN.jar -XX:ParallelGCThreads<span class="token operator">=</span>4 -XX:+AggressiveHeap -XX:+UseParallelGC -jar cobaltstrike.jar
java -XX:ParallelGCThreads<span class="token operator">=</span>4 -XX:+AggressiveHeap -XX:+UseParallelGC -Xms512M -Xmx1024M -jar cobaltstrike.jar</code></pre>
<h1 id="分布式和团队行动"><a href="#分布式和团队行动" class="headerlink" title="分布式和团队行动"></a>分布式和团队行动</h1><ol>
<li><p><code>分布式行动模型</code>：架构多台团队服务器，也<br>就是分解整个攻击链，这是分布式行动模型的<code>基本思想</code></p>
</li>
<li></li>
<li><blockquote>
<p>一旦连接至一个团队服务器，你的团队将：<br>使用相同的会话<br>分享主机、捕获的数据和下载的文件<br>通过一个共享的事件日志交流</p>
</blockquote>
</li>
</ol>
<h2 id="日志和报告功能"><a href="#日志和报告功能" class="headerlink" title="日志和报告功能"></a>日志和报告功能</h2><h3 id="logs"><a href="#logs" class="headerlink" title="logs"></a>logs</h3><h3 id="报告"><a href="#报告" class="headerlink" title="报告"></a>报告</h3><h2 id="最基本的多团队服务器模型"><a href="#最基本的多团队服务器模型" class="headerlink" title="最基本的多团队服务器模型"></a>最基本的多团队服务器模型</h2><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107132806747.png" alt="image-20201107132806747"></p>
<h2 id="结合攻击链的多团队服务器模型："><a href="#结合攻击链的多团队服务器模型：" class="headerlink" title="结合攻击链的多团队服务器模型："></a>结合攻击链的多团队服务器模型：</h2><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107132948410.png" alt="image-20201107132948410"></p>
<h2 id="具有权限管理单元的多团队服务器模型"><a href="#具有权限管理单元的多团队服务器模型" class="headerlink" title="具有权限管理单元的多团队服务器模型"></a>具有权限管理单元的多团队服务器模型</h2><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107133335118.png" alt="image-20201107133335118"></p>
<h1 id="teamserver"><a href="#teamserver" class="headerlink" title="teamserver"></a>teamserver</h1><ol>
<li><pre class=" language-javascript"><code class="language-javascript"><span class="token punctuation">.</span><span class="token operator">/</span>teamserver <span class="token operator">&lt;</span>host<span class="token operator">></span> <span class="token operator">&lt;</span>password<span class="token operator">></span> <span class="token punctuation">[</span><span class="token operator">/</span>path<span class="token operator">/</span>to<span class="token operator">/</span>c2<span class="token punctuation">.</span>profile<span class="token punctuation">]</span> <span class="token punctuation">[</span>YYYY<span class="token operator">-</span>MM<span class="token operator">-</span>DD<span class="token punctuation">]</span>
<span class="token operator">&lt;</span>host<span class="token operator">></span> 必需参数 团队服务器IP
<span class="token operator">&lt;</span>password<span class="token operator">></span> 必需参数 连接服务器的密码
<span class="token punctuation">[</span><span class="token operator">/</span>path<span class="token operator">/</span>to<span class="token operator">/</span>c2<span class="token punctuation">.</span>profile<span class="token punctuation">]</span> 可选参数 指定C2通信配置文件，体现其强大的扩展性
<span class="token punctuation">[</span>YYYY<span class="token operator">-</span>MM<span class="token operator">-</span>DD<span class="token punctuation">]</span> 可选参数 所有payload的终止时间

# 启动Team Server
<span class="token punctuation">.</span><span class="token operator">/</span>teamserver <span class="token number">192.168</span><span class="token punctuation">.</span><span class="token number">183.147</span> <span class="token number">123456</span> # kali的IP地址 设置强密码，否则容易被爆破，参考附录</code></pre>
</li>
</ol>
<h1 id="客户端"><a href="#客户端" class="headerlink" title="客户端"></a>客户端</h1><ol>
<li>Linux：./cobaltstrike或 java -XX:+AggressiveHeap -XX:+UseParallelGC -jar cobaltstrike.jar Windows：双击cobaltstrike.exe</li>
</ol>
<h1 id="Infrastructure"><a href="#Infrastructure" class="headerlink" title="Infrastructure"></a>Infrastructure</h1><h2 id="THE-PEER-TO-PEER-SMB"><a href="#THE-PEER-TO-PEER-SMB" class="headerlink" title="THE PEER-TO-PEER SMB"></a>THE PEER-TO-PEER SMB</h2><h3 id="SMB协议"><a href="#SMB协议" class="headerlink" title="SMB协议"></a>SMB协议</h3><h3 id="命名管道（name-pipe）"><a href="#命名管道（name-pipe）" class="headerlink" title="命名管道（name pipe）"></a>命名管道（name pipe）</h3><h4 id="通过windowsapi实现命名管道来控制计算机通信"><a href="#通过windowsapi实现命名管道来控制计算机通信" class="headerlink" title="通过windowsapi实现命名管道来控制计算机通信"></a>通过windowsapi实现命名管道来控制计算机通信</h4><ol>
<li><p>make_token()</p>
</li>
<li><p>LogonUserA()</p>
<p><a href="https://rcoil.me/2019/12/%E3%80%90%E6%B8%97%E9%80%8F%E6%8A%80%E5%B7%A7%E3%80%91SCshell%20%E6%8A%80%E6%9C%AF%E7%BB%86%E8%8A%82/" target="_blank" rel="noopener">https://rcoil.me/2019/12/%E3%80%90%E6%B8%97%E9%80%8F%E6%8A%80%E5%B7%A7%E3%80%91SCshell%20%E6%8A%80%E6%9C%AF%E7%BB%86%E8%8A%82/</a></p>
</li>
</ol>
<h2 id="TCP-Beacons"><a href="#TCP-Beacons" class="headerlink" title="TCP Beacons"></a>TCP Beacons</h2><h2 id="External-C2（外部C2）"><a href="#External-C2（外部C2）" class="headerlink" title="External C2（外部C2）"></a>External C2（外部C2）</h2><p><a href="http://blog.leanote.com/post/snowming/50448511de58" target="_blank" rel="noopener">http://blog.leanote.com/post/snowming/50448511de58</a></p>
<blockquote>
<p> Command &amp; Control Server (命令与控制服务器)</p>
</blockquote>
<ol>
<li><p>未来：基于但不限于框架、使用多种方法、拓展协议实现C2 通信</p>
</li>
<li><p>基于外部C2的CS通信模型</p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107134614583.png" alt="image-20201107134614583"></p>
</li>
<li><p>实现</p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107135010939.png" alt="image-20201107135010939"></p>
</li>
<li><p>使用外部C2的CS通信架构模型</p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201107135305356.png" alt="image-20201107135305356"></p>
</li>
</ol>
<h1 id="Malleable-C2-Profile-功能"><a href="#Malleable-C2-Profile-功能" class="headerlink" title="Malleable C2 Profile 功能"></a>Malleable C2 Profile 功能</h1><p><a href="https://github.com/rsmudge/Malleable-C2-Profiles" target="_blank" rel="noopener">https://github.com/rsmudge/Malleable-C2-Profiles</a></p>
<blockquote>
<ol>
<li>./teamserver [团队服务器的 IP] [password] [c2 profile]</li>
<li>比起来，可拓展 C2 的好处就是配置简单，外部 C2 的好处是隐蔽性更好、绕防火<br>墙等限制的效果更好，可以拓展协议，但是实现起来比较难</li>
</ol>
</blockquote>
<h1 id="man-in-the-middle-attacks"><a href="#man-in-the-middle-attacks" class="headerlink" title="man-in-the-middle attacks"></a>man-in-the-middle attacks</h1><h1 id="小问题"><a href="#小问题" class="headerlink" title="小问题"></a>小问题</h1><ol>
<li><p>![image-20201105142601374](C:\Users\RESCUER\AppData\Roaming\Typora\typora-user-images\image-20201105142601374.png</p>
</li>
<li><p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201105142653105.png" alt="image-20201105142653105"></p>
</li>
<li><blockquote>
<p>CS 转发流量到 MSF（或相反的方向），流量是 MSF 和 CS 客户端直连呢？还是走的 CS 的团队服务器进行转发呢？</p>
<blockquote>
<blockquote>
<p>CS 与 MSF 之间的流量转发，其实是 CS 团队服务器与 MSF 之间的流量转发。客户端作为第三方只是与 CS 团队服务器进行交互</p>
</blockquote>
</blockquote>
</blockquote>
</li>
</ol>
<h1 id="学着用用"><a href="#学着用用" class="headerlink" title="学着用用"></a>学着用用</h1><ol>
<li><p>成功启动步骤</p>
<ol>
<li><p>ip addr</p>
<blockquote>
<p>查看kali机器ip地址</p>
</blockquote>
</li>
<li><p>nohup ./teamserver 192.168.150.132 password &amp;（回车两次）</p>
<blockquote>
<p>开启团队服务器,服务端即可在后台运行</p>
<p><code>nohup</code>和<code>&amp;</code>表示在后台运行</p>
<p>./teamserver为团队服务器启动程序</p>
</blockquote>
</li>
<li><p>java -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -Xms512M -Xmx1024M -jar cobaltstrike.jar</p>
</li>
</ol>
</li>
<li><p>就一个启动搞了半天，好气哦</p>
</li>
</ol>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201105140849579.png" alt="image-20201105140849579"></p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201105141002935.png" alt="image-20201105141002935"></p>
<h2 id="建立Listener"><a href="#建立Listener" class="headerlink" title="建立Listener"></a>建立Listener</h2><h2 id="文件浏览器"><a href="#文件浏览器" class="headerlink" title="文件浏览器"></a>文件浏览器</h2><p>##生成一个木马</p>
<h2 id="网站克隆"><a href="#网站克隆" class="headerlink" title="网站克隆"></a>网站克隆</h2><h2 id="提权"><a href="#提权" class="headerlink" title="提权"></a>提权</h2><h2 id="获取Hash"><a href="#获取Hash" class="headerlink" title="获取Hash"></a>获取Hash</h2><h2 id="Mimikatz"><a href="#Mimikatz" class="headerlink" title="Mimikatz"></a>Mimikatz</h2><h2 id="内网代理——cobaltstrike代理"><a href="#内网代理——cobaltstrike代理" class="headerlink" title="内网代理——cobaltstrike代理"></a>内网代理——cobaltstrike代理</h2><h2 id="过360-Defender"><a href="#过360-Defender" class="headerlink" title="过360+Defender"></a>过360+Defender</h2><h2 id="绕过流量审计"><a href="#绕过流量审计" class="headerlink" title="绕过流量审计"></a>绕过流量审计</h2><p><a href="https://paper.seebug.org/1349/" target="_blank" rel="noopener">https://paper.seebug.org/1349/</a></p>
<h2 id="内网渗透"><a href="#内网渗透" class="headerlink" title="内网渗透"></a>内网渗透</h2><p><a href="http://blog.nsfocus.net/cobalt-strike-phishing-0913/" target="_blank" rel="noopener">http://blog.nsfocus.net/cobalt-strike-phishing-0913/</a></p>
<h2 id="内网流量规避"><a href="#内网流量规避" class="headerlink" title="内网流量规避"></a>内网流量规避</h2><p><a href="https://www.anquanke.com/post/id/210848#h2-1" target="_blank" rel="noopener">https://www.anquanke.com/post/id/210848#h2-1</a></p>
<h4 id="IPS"><a href="#IPS" class="headerlink" title="IPS"></a>IPS</h4><h4 id="IDS"><a href="#IDS" class="headerlink" title="IDS"></a>IDS</h4><h1 id="看了这么多文章问问自己它可以用来干嘛"><a href="#看了这么多文章问问自己它可以用来干嘛" class="headerlink" title="看了这么多文章问问自己它可以用来干嘛"></a>看了这么多文章问问自己它可以用来干嘛</h1><h1 id="感觉好多坑，好烦哦"><a href="#感觉好多坑，好烦哦" class="headerlink" title="感觉好多坑，好烦哦"></a>感觉好多坑，好烦哦</h1><ol>
<li><a href="https://blog.csdn.net/weixin_41585557/article/details/88357980" target="_blank" rel="noopener">https://blog.csdn.net/weixin_41585557/article/details/88357980</a></li>
<li>./teamserver permission denied</li>
</ol>

            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">YeOrLuOp</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://wang468.github.io/2020/11/08/cobaltstrike/">https://wang468.github.io/2020/11/08/cobaltstrike/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">YeOrLuOp</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/tags/%E5%B7%A5%E5%85%B7/">
                                    <span class="chip bg-color">工具</span>
                                </a>
                            
                                <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                                    <span class="chip bg-color">学习笔记</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    

    

</div>

                </div>
            </div>
            
        </div>
    </div>

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="fas fa-chevron-left"></i>&nbsp;上一篇</div>
            <div class="card">
                <a href="/2020/11/12/c/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/19.jpg" class="responsive-img" alt="C">
                        
                        <span class="card-title">C</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                        <span class="publish-date">
                            <i class="far fa-clock fa-fw icon-date"></i>2020-11-12
                        </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-user fa-fw"></i>
                            YeOrLuOp
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/C/">
                        <span class="chip bg-color">C</span>
                    </a>
                    
                    <a href="/tags/%E5%AD%A6%E8%BF%87%E7%9A%84%E4%B8%9C%E8%A5%BF%E5%81%9A%E4%B8%AA%E8%AE%B0%E5%BD%95/">
                        <span class="chip bg-color">学过的东西做个记录</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2020/11/04/sql-zhu-ru/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/3.jpg" class="responsive-img" alt="SQL注入">
                        
                        <span class="card-title">SQL注入</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-11-04
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-user fa-fw"></i>
                            YeOrLuOp
                            
                        </span>
                    </div>
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>


<!-- 代码块折行 -->

<style type="text/css">
code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
</style>


    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget card" style="background-color: white;">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h1, h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h1, h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="503838841"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='random'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js"></script>

    
    <div class="container row center-align" style="margin-bottom: 15px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            
                <span id="year">2020-2021</span>
            
            <span id="year">2020</span>
            <a href="/about" target="_blank">YeOrLuOp</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            <br>
            
            &nbsp;<i class="fas fa-chart-area"></i>&nbsp;站点总字数:&nbsp;<span
                class="white-color">18.8k</span>&nbsp;字
            
            
            
            
            
            
            
            <br>
            
            <span id="sitetime">载入运行时间...</span>
            <script>
                function siteTime() {
                    var seconds = 1000;
                    var minutes = seconds * 60;
                    var hours = minutes * 60;
                    var days = hours * 24;
                    var years = days * 365;
                    var today = new Date();
                    var startYear = "2020";
                    var startMonth = "08";
                    var startDate = "15";
                    var startHour = "0";
                    var startMinute = "0";
                    var startSecond = "0";
                    var todayYear = today.getFullYear();
                    var todayMonth = today.getMonth() + 1;
                    var todayDate = today.getDate();
                    var todayHour = today.getHours();
                    var todayMinute = today.getMinutes();
                    var todaySecond = today.getSeconds();
                    var t1 = Date.UTC(startYear, startMonth, startDate, startHour, startMinute, startSecond);
                    var t2 = Date.UTC(todayYear, todayMonth, todayDate, todayHour, todayMinute, todaySecond);
                    var diff = t2 - t1;
                    var diffYears = Math.floor(diff / years);
                    var diffDays = Math.floor((diff / days) - diffYears * 365);
                    var diffHours = Math.floor((diff - (diffYears * 365 + diffDays) * days) / hours);
                    var diffMinutes = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours) /
                        minutes);
                    var diffSeconds = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours -
                        diffMinutes * minutes) / seconds);
                    if (startYear == todayYear) {
                        document.getElementById("year").innerHTML = todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffDays + " 天 " + diffHours +
                            " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    } else {
                        document.getElementById("year").innerHTML = startYear + " - " + todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffYears + " 年 " + diffDays +
                            " 天 " + diffHours + " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    }
                }
                setInterval(siteTime, 1000);
            </script>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/wang468" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>















</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script src="/js/search.js"></script>
<script type="text/javascript">
$(function () {
    searchFunc('/search.xml', 'searchInput', 'searchResult');
});
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
